# Subako Docs

> Documentation for Subako — the cloud platform for the multi-agent era.

## Docs

- [Introduction](https://docs.subako.ai/introduction): Subako is the runtime your product's AI agents run on — long-running sessions, secure code execution, credentials, and skills, reachable from one API.
- [Quickstart](https://docs.subako.ai/quickstart): Create an organization, publish an agent version, and run your first session — start to finish, from the terminal and one HTTP call.

## Concepts

- [Organizations and workspaces](https://docs.subako.ai/concepts/workspaces): The two scopes everything in Subako belongs to — who is billed, and where the work lives.
- [Agents and versions](https://docs.subako.ai/concepts/agents): An agent is a name; its versions hold the model, the prompt, and the grants. Sessions bind a version and keep it.
- [Sessions and runs](https://docs.subako.ai/concepts/sessions): A session is an append-only event log. A run is one pass of the engine over it. Everything you can observe about an agent is an event.
- [Skills](https://docs.subako.ai/concepts/skills): Bundles of knowledge and procedure, versioned in a workspace and granted to an agent version.
- [Vaults and credentials](https://docs.subako.ai/concepts/vaults): Where a session's tool credentials live. The broker uses them at call time; the engine and the model never see them.
- [Model providers](https://docs.subako.ai/concepts/model-providers): The upstream a published agent version runs against — Subako's own models, or your account with an upstream of your own.
- [Plans and billing](https://docs.subako.ai/concepts/plans-and-billing): What each plan includes, what Subako Credits pay for, and how an organization subscribes, changes plan, and tops up.

## Guides

- [Streaming events](https://docs.subako.ai/guides/streaming-events): Tail a session's log over SSE, and pick back up from where you stopped when the connection drops.
- [Client tools](https://docs.subako.ai/guides/client-tools): Register your app as a client on a session, declare the tools it offers, and answer the calls the model routes to you.
- [Approvals](https://docs.subako.ai/guides/approvals): Put a human in front of a tool call, and settle it from your own UI.

## Reference

- [Permissions](https://docs.subako.ai/reference/permissions): What an API key can be granted, and what only a member can do.
- [Event reference](https://docs.subako.ai/reference/events): Every event kind a session log can carry, and what each one carries with it.

## Cli

- [subako CLI reference](https://docs.subako.ai/cli): Subako client: sign up, sign in, and drive the Subako API from the terminal

### Commands

- [subako agent](https://docs.subako.ai/cli/commands/agent): Agents: the unit of work a session runs, and its published versions
- [subako api-key](https://docs.subako.ai/cli/commands/api-key): API keys: the machine credentials a workspace's work runs under
- [subako cloud](https://docs.subako.ai/cli/commands/cloud): Subako Cloud self-service
- [subako docs](https://docs.subako.ai/cli/commands/docs): Offline documentation generated from this CLI's command definitions
- [subako login](https://docs.subako.ai/cli/commands/login): Sign in via the device-authorization flow
- [subako logout](https://docs.subako.ai/cli/commands/logout): Sign out and remove the stored credential
- [subako model-provider](https://docs.subako.ai/cli/commands/model-provider): Model providers: the upstream a published agent version runs against
- [subako org](https://docs.subako.ai/cli/commands/org): The signed-in organization, its members, and its invitations
- [subako profile](https://docs.subako.ai/cli/commands/profile): Credential profile administration
- [subako skill](https://docs.subako.ai/cli/commands/skill): Skills: the bundles an agent's config may grant it
- [subako vault](https://docs.subako.ai/cli/commands/vault): Vaults: where a session's tool credentials live
- [subako whoami](https://docs.subako.ai/cli/commands/whoami): Print the signed-in identity
- [subako workspace](https://docs.subako.ai/cli/commands/workspace): Workspaces: the scope every unit of work belongs to

## Api

- [Subako Public API](https://docs.subako.ai/api)

### agents

- [GET /v1/agents](https://docs.subako.ai/api/agents/list-agents)
- [POST /v1/agents](https://docs.subako.ai/api/agents/create-agent)
- [GET /v1/agents/{agent_id}](https://docs.subako.ai/api/agents/get-agent)
- [DELETE /v1/agents/{agent_id}](https://docs.subako.ai/api/agents/delete-agent)
- [PATCH /v1/agents/{agent_id}](https://docs.subako.ai/api/agents/rename-agent)
- [GET /v1/agents/{agent_id}/security](https://docs.subako.ai/api/agents/get-agent-security)
- [PUT /v1/agents/{agent_id}/security](https://docs.subako.ai/api/agents/set-agent-security)
- [GET /v1/agents/{agent_id}/versions](https://docs.subako.ai/api/agents/list-agent-versions)
- [POST /v1/agents/{agent_id}/versions](https://docs.subako.ai/api/agents/publish-version)

### api-keys

- [GET /v1/api-keys](https://docs.subako.ai/api/api-keys/list-api-keys)
- [POST /v1/api-keys](https://docs.subako.ai/api/api-keys/mint-api-key)
- [DELETE /v1/api-keys/{api_key_id}](https://docs.subako.ai/api/api-keys/revoke-api-key)

### clients

- [POST /v1/sessions/{session_id}/clients](https://docs.subako.ai/api/clients/register-client)
- [DELETE /v1/sessions/{session_id}/clients/{client_id}](https://docs.subako.ai/api/clients/leave-client)
- [POST /v1/sessions/{session_id}/clients/{client_id}/calls/{call_id}/ack](https://docs.subako.ai/api/clients/ack-client-call)
- [PUT /v1/sessions/{session_id}/clients/{client_id}/tools](https://docs.subako.ai/api/clients/update-client-tools)
- [Answers 204 where [`ack_client_call`] answers the appended row, because
settling a call appends nothing of its own. The content goes onto the
call's row and reaches the log as the `tool_result` the engine journals
once the broker hands the answer over, so core appending one here would
make two writers for the same event.](https://docs.subako.ai/api/clients/answer-client-call)
- [Use a new key for each heartbeat. Reusing one returns the saved expiration
without extending the registration again.](https://docs.subako.ai/api/clients/ping-client)

### me

- [GET /v1/me](https://docs.subako.ai/api/me/get-me)

### model-providers

- [GET /v1/model-providers](https://docs.subako.ai/api/model-providers/list-model-providers)
- [POST /v1/model-providers](https://docs.subako.ai/api/model-providers/create-workspace-model-provider)
- [GET /v1/model-providers/{model_provider_id}](https://docs.subako.ai/api/model-providers/get-model-provider)
- [DELETE /v1/model-providers/{model_provider_id}](https://docs.subako.ai/api/model-providers/delete-model-provider)
- [PATCH /v1/model-providers/{model_provider_id}](https://docs.subako.ai/api/model-providers/update-model-provider)

### organization

- [GET /v1/organization](https://docs.subako.ai/api/organization/get-organization)
- [PATCH /v1/organization](https://docs.subako.ai/api/organization/rename-organization)
- [GET /v1/organization/credits](https://docs.subako.ai/api/organization/get-credits)
- [GET /v1/organization/invitations](https://docs.subako.ai/api/organization/list-invitations)
- [POST /v1/organization/invitations](https://docs.subako.ai/api/organization/create-invitation)
- [DELETE /v1/organization/invitations/{invitation_id}](https://docs.subako.ai/api/organization/revoke-invitation)
- [GET /v1/organization/members](https://docs.subako.ai/api/organization/list-members)
- [PUT /v1/organization/members/{user_id}](https://docs.subako.ai/api/organization/change-member-role)
- [DELETE /v1/organization/members/{user_id}](https://docs.subako.ai/api/organization/remove-member)
- [GET /v1/organization/usage](https://docs.subako.ai/api/organization/list-usage)

### sessions

- [GET /v1/sessions](https://docs.subako.ai/api/sessions/list-sessions)
- [POST /v1/sessions](https://docs.subako.ai/api/sessions/create-session)
- [GET /v1/sessions/{session_id}](https://docs.subako.ai/api/sessions/get-session)
- [DELETE /v1/sessions/{session_id}](https://docs.subako.ai/api/sessions/delete-session)
- [POST /v1/sessions/{session_id}/approvals/{call_id}](https://docs.subako.ai/api/sessions/resolve-approval)
- [POST /v1/sessions/{session_id}/cancel](https://docs.subako.ai/api/sessions/cancel-session-run)
- [GET /v1/sessions/{session_id}/events](https://docs.subako.ai/api/sessions/list-session-events)
- [POST /v1/sessions/{session_id}/events](https://docs.subako.ai/api/sessions/post-session-event)
- [POST /v1/sessions/{session_id}/tokens](https://docs.subako.ai/api/sessions/mint-session-token)
- [The same log as a live tail, framed as SSE: one event per row, `id` the
seq, `event` the wire `type`, `data` the same [`SessionEventBody`] the
paged read renders. The stream stays open across idle stretches -- a
keep-alive comment holds the connection while nothing happens -- so one
connection spans a session's whole life rather than a single run. With no
position named it starts at the live head, fixed before the response
begins; a client that wants history pages `/events` newest-first and
deduplicates on seq against what the tail delivers.
An initial id-only frame establishes the reconnect cursor without
dispatching a message. Continuity before that frame is received requires
an explicit `after_seq`.](https://docs.subako.ai/api/sessions/stream-session-events)

### skills

- [GET /v1/skills](https://docs.subako.ai/api/skills/list-skills)
- [POST /v1/skills](https://docs.subako.ai/api/skills/create-skill)
- [GET /v1/skills/{skill_id}](https://docs.subako.ai/api/skills/get-skill)
- [DELETE /v1/skills/{skill_id}](https://docs.subako.ai/api/skills/delete-skill)
- [PATCH /v1/skills/{skill_id}](https://docs.subako.ai/api/skills/rename-skill)
- [GET /v1/skills/{skill_id}/versions](https://docs.subako.ai/api/skills/list-skill-versions)
- [POST /v1/skills/{skill_id}/versions](https://docs.subako.ai/api/skills/push-skill-version)

### vaults

- [GET /v1/vaults](https://docs.subako.ai/api/vaults/list-vaults)
- [POST /v1/vaults](https://docs.subako.ai/api/vaults/create-vault)
- [GET /v1/vaults/{vault_id}](https://docs.subako.ai/api/vaults/get-vault)
- [DELETE /v1/vaults/{vault_id}](https://docs.subako.ai/api/vaults/delete-vault)
- [PATCH /v1/vaults/{vault_id}](https://docs.subako.ai/api/vaults/update-vault)
- [GET /v1/vaults/{vault_id}/credentials](https://docs.subako.ai/api/vaults/list-credentials)
- [POST /v1/vaults/{vault_id}/credentials](https://docs.subako.ai/api/vaults/add-credential)
- [DELETE /v1/vaults/{vault_id}/credentials/{credential_id}](https://docs.subako.ai/api/vaults/delete-credential)

### workspaces

- [GET /v1/workspaces](https://docs.subako.ai/api/workspaces/list-workspaces)
- [POST /v1/workspaces](https://docs.subako.ai/api/workspaces/create-workspace)
- [GET /v1/workspaces/{workspace_id}](https://docs.subako.ai/api/workspaces/get-workspace)
- [DELETE /v1/workspaces/{workspace_id}](https://docs.subako.ai/api/workspaces/delete-workspace)
- [PATCH /v1/workspaces/{workspace_id}](https://docs.subako.ai/api/workspaces/rename-workspace)
- [GET /v1/workspaces/{workspace_id}/members](https://docs.subako.ai/api/workspaces/list-workspace-members)
- [POST /v1/workspaces/{workspace_id}/members](https://docs.subako.ai/api/workspaces/add-workspace-member)
- [PUT /v1/workspaces/{workspace_id}/members/{user_id}](https://docs.subako.ai/api/workspaces/change-workspace-member-role)
- [DELETE /v1/workspaces/{workspace_id}/members/{user_id}](https://docs.subako.ai/api/workspaces/remove-workspace-member)
- [GET /v1/workspaces/{workspace_id}/usage](https://docs.subako.ai/api/workspaces/list-workspace-usage)

## Agent resources

- [llms-full.txt](https://docs.subako.ai/llms-full.txt): The full Markdown of every page in one file.
- [Page Markdown](https://docs.subako.ai/index.md): Append `.md` to any page URL to fetch that page as raw Markdown.
- [API catalog](https://docs.subako.ai/.well-known/api-catalog): RFC 9727 linkset of the APIs documented here.
- [agent-readability.json](https://docs.subako.ai/agent-readability.json): Manifest of every agent-facing artifact on this site.
- [Sitemap](https://docs.subako.ai/sitemap.xml): Every indexable page URL with its last-modified date.